Samsung MFP SECURITY Quick reference guide

Samsung MFP Security
White Paper: Samsung Security Framework
12
3
45
Secure
User
Secure
Data
Secure
Network
Secure
Document
Secure
Management

WHITE PAPER SAMSUNG MFP SECURITY
Page - 2 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
© 2014 Samsung Electronics Co., Ltd. All rights reserved.
Samsung Electronics provides this guide for information purposes only. All information included herein is subject to change without notice.
Samsung Electronics is not responsible for any direct or indirect damages that may occur when you use this guide or that you relate to the use of this guide.
Samsung and Samsung logo are trademarks of Samsung Electronics Co., Ltd.
All other brand or product names are trademarks of their respective companies or organizations.
Version – Draft

SAMSUNG MFP SECURITY WHITE PAPER
Page - 3 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
Table of Contents
1. Introduction .......................................................................................................................................6
1.1 Information Security ..............................................................................................................................6
1.2 The Objectives of Multifunction Printer (MFP) Security ........................................................................7
1.2.1 MFP Hardcopy Vulnerability ....................................................................................................... 8
1.2.2 MFP Electronic Vulnerability....................................................................................................... 8
1.2.3 Common Results of Having an Unsecured MFP .........................................................................8
2. Security Regulatory Requirements.......................................................................................................9
3. Security Business Requirements ........................................................................................................10
3.1 Public Sector (Government / Education / Healthcare) Security Requirements..................................10
3.1.1 Government..............................................................................................................................10
3.1.2 Education .................................................................................................................................. 11
3.1.3 Healthcare.................................................................................................................................11
3.2 Private Sector Security Requirements..................................................................................................12
4. Common Criteria Security Validation .................................................................................................13
5. IEEE 2600™-2008, IEEE 2600.1™-2009, IEEE 2600.2™-2009 (2) ..............................................................14
6. Samsung’s Security Framework .........................................................................................................15
7. Secure User ......................................................................................................................................16
7.1 Authentication......................................................................................................................................17
7.1.1 System Authentication.............................................................................................................. 17
7.1.2Local Authentication................................................................................................................. 17
7.1.3 Network Authentication ...........................................................................................................17
7.1.4 XOA –E / XOA Web Authentication...........................................................................................17
7.2 User Authentication Scenarios.............................................................................................................18
7.2.1 For Administrators ....................................................................................................................18
7.3 Authorization (Group/Role Management)...........................................................................................19
7.3.1 Using Group and Role-Based Authority ....................................................................................19
7.4 User Authorization Scenarios...............................................................................................................20
7.4.1 Administrator Menu .................................................................................................................20
7.5 Accounting............................................................................................................................................21
7.5.1 Standard and Network Accounting...........................................................................................21
7.6 User Accounting Scenarios...................................................................................................................21
7.6.1 For Administrators ....................................................................................................................21
7.6.2 For Users ...................................................................................................................................21
7.7 Single Sign-On (SSO).............................................................................................................................22
7.8 Key Benefits of “Secure User”..............................................................................................................22
7.8.1 Good Basic Security...................................................................................................................22
7.8.2 Increased Productivity ..............................................................................................................22
7.8.3 Cost Control ..............................................................................................................................22
8. Secure Data ......................................................................................................................................23

WHITE PAPER SAMSUNG MFP SECURITY
Page - 4 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
8.1 Encryption ............................................................................................................................................23
8.1.1 Hard Disk Drive (HDD) Encryption ............................................................................................23
8.1.2 Print Job Encryption..................................................................................................................25
8.1.3 Secure PDF - PDF Encryption ....................................................................................................26
8.1.4 Secure PDF – Digital Signature in PDF.......................................................................................26
8.1.5 Digital Certificate ......................................................................................................................27
8.1.6 PC Scan Security........................................................................................................................28
8.1.7 Secure E-mail (SMTPs) ..............................................................................................................28
8.2 Image Overwrite...................................................................................................................................29
8.2.1 Automatic Image Overwrite .....................................................................................................29
8.2.2 Manual Image Overwrite ..........................................................................................................29
8.2.3 Scheduled Image Overwrite......................................................................................................29
8.2.4 Image Overwrite from the Local UI...........................................................................................29
8.3 Information Hiding ...............................................................................................................................30
8.4 Key Benefits of Using Secure Data .......................................................................................................31
8.4.1 Data Protection.........................................................................................................................31
8.4.2 Various Options Settings........................................................................................................... 31
9. Secure Network ................................................................................................................................32
9.1 Transport Layer Security (TLS) / Secure Sockets Layer (SSL)................................................................32
9.2 SNMPv3 ................................................................................................................................................32
9.3 IP Security (IPSec): IPv4, IPv6 ...............................................................................................................33
9.4 802.1x Support .....................................................................................................................................34
9.5 Protocol/Port Management.................................................................................................................35
9.6 IP/MAC Filtering ...................................................................................................................................35
9.7 Key Benefit of Using Secure Network ..................................................................................................35
10. Secure Document..............................................................................................................................36
10.1 Confidential Print .................................................................................................................................36
10.2 Secure Fax ............................................................................................................................................36
10.3 Document Tagging ...............................................................................................................................37
10.3.1 Watermarks ..............................................................................................................................37
10.3.2 Stamp ........................................................................................................................................38
11. Secure Management .........................................................................................................................39
11.1 Logging (Job Auditing) ..........................................................................................................................39
11.1.1 Job Log ......................................................................................................................................40
11.1.2 SYS Log ......................................................................................................................................40
11.1.3 Operation Log ........................................................................................................................... 40
11.1.4 Security Event Log.....................................................................................................................40
11.2 Log Features .........................................................................................................................................40
11.3 System Back-Up....................................................................................................................................42
11.4 Email Notification.................................................................................................................................42
11.4.1 Device Alert Notification...........................................................................................................43
11.4.2 Device Status Notification.........................................................................................................43
12. Samsung Business Core
TM
MFP Security Solutions ..............................................................................44

SAMSUNG MFP SECURITY WHITE PAPER
Page - 5 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
12.1 SmarThruTM Workflow Lite...................................................................................................................45
12.2 Cloud Connector...................................................................................................................................47
12.3 Secure Login Manager..........................................................................................................................48
12.4 SecuThruTM Lite 2..................................................................................................................................49
12.5 Usage Tracker.......................................................................................................................................51
13. Smart Print UX with Android Security ................................................................................................52
14. Key Benefits of Samsung MFP Security ..............................................................................................53
15. Conclusion ........................................................................................................................................54

WHITE PAPER SAMSUNG MFP SECURITY
Page - 6 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
1. Introduction
The security of valuable information was an easy process back in the early days of computing. All of the data was kept on
tapes and disks, which were not accessible to anybody outside of the building. However, now with networks connecting
everything to the outside world, security leaks can occur anywhere.
IT professionals are faced with managing an assortment of devices that can allow security breaches. This overwhelming
burden of device management has led IT managers to demand better security features from the manufacturers of the
devices they use.
Samsung has responded to the requests of our IT customers and created security features for our MFPs that protect
valuable data from unauthorized access.
1.1 Information Security
In our digital information-based society, we have become more aware of the perils associated with sharing information. In
the name of productivity we have created increasingly easier ways to share information, at faster speeds and with higher
bandwidth. The downside to this increase in sharability is the decrease in our ability to secure our information. Search
engines and sniffers are constantly monitoring networks for information, usually for innocuous purposes, but sometimes
the reasons are malicious.
To address this situation we need to understand the path information travels and then we can identify the vulnerabilities
the information can encounter. A simple path is one that uses a single connection such as the path from a computer to a
printer:
A complex path can include several connections over various wired and wireless networks such as sending an email from a
cell phone to several distant locations.
In the Information Technology field, our goal is to make information highly available, but only to the desired recipients.
The tools we use to achieve this goal include data encryption and user authentication.

SAMSUNG MFP SECURITY WHITE PAPER
Page - 7 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
1.2 The Objectives of Multifunction Printer (MFP) Security
Information is a resource that by its nature is most valuable when it is being shared with a group working together to
achieve a goal. It is this ability to share information over great distances at the speed of light that has created the
technological world we live in today. Unfortunately the creation of so many ways to access information has also resulted
in so many more ways for unauthorized access to information. So the dilemma IT professionals are faced with is “how do I
balance high availability of information with high security?”
Many formulas and strategies have been developed to determine the level of security that is required and the amount of
harm that would result from breaches in security. This is useful for accounting purposes to determine the cost of security.
However these accounting tools do not help the IT professional implement security.
Samsung has targeted the MFP security as the area of information security where we can add the most value for our IT
customers. MFPs offer many features that process information electronically and on paper. This means that the security
objectives for MFPs must address and target the vulnerabilities of these features.
MF
P
PC
PC
Security Vulnerable Point
Input
Document
Output
Document
Output Privacy
Invasion
Network
Penetration
Network
Sniffing
Unauthorized
Copy
Unauthorized
Access
Retained
Information
Theft
Unauthorized
FAX Access
Unauthorized
USB Access

WHITE PAPER SAMSUNG MFP SECURITY
Page - 8 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
1.2.1 MFP Hardcopy Vulnerability
The primary task of an MFP is to print documents. Printed documents are vulnerable to both unintentional and intentional
security breaches. Potential document security issues include the following:
•Unintentional removal
•Paper jams
•Intentional removal
•Copying
1.2.2 MFP Electronic Vulnerability
The additional tasks an MFP performs (Copy, FAX, Scan, Email, Network, Document Storage), create many more
opportunities for security breaches. These tasks all share a common process – electronic routing of the information.
During this electronic routing, the information can be stored on and transferred through many vulnerable locations on the
MFP. These locations can include the following:
•Phone line (FAX)
•Ethernet (network connection)
•Hard Drive (stored documents from fax, E-mail, network, and scan)
•USB
1.2.3 Common Results of Having an Unsecured MFP
Some of the most common results associated with an unsecured MFP include the following:
•Unauthorized use by a malicious user
•Identity theft
•Stolen information
•Lawsuits from stolen information
•Loss of access
•Loss of productivity.

SAMSUNG MFP SECURITY WHITE PAPER
Page - 9 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
2. Security Regulatory Requirements
The importance of the information that is flowing through private and public devices has resulted in the need for broad
regulations to protect this information. Some of these regulations were directly developed to protect information such as
medical records. Other regulations are indirect effects from other sources such as the need for document audit trails for
SOX financial regulation compliance.
Samsung is continuously working with our industry partners to create compatible MFPs that meet the regulatory
requirements of today’s information infrastructure. The MFP security features presented in this paper are able to meet or
exceed the current regulatory requirements of our customers.
Family Education
Rights and Privacy Act
(FERPA) prohibits the
disclosure of personally
identifiable education
information without
the written permission
of the student or their
guardian.
Health Insurance
Portability and
Accountability Act of
1996 (HIPAA) forces all
healthcare
organizations to
uniformly manage data
to protect patient
information and
privacy at all times.
For Gramm-Leach-
Bliley Act of 1999
(GLBA) compliance,
organizations must
complete a risk analysis
on their current
processes and
implement firewalls,
user access, monitor
printing, and more.
Federal Information
Security Management
Act of 2002 (FISMA)
requires that all
networked devices
meet strict information
assurance.
•CC-ISO15408
•FDIC
•IEEE 2600-2008
•IEEE 2600.1-2009
•DoD 5200.2
•HSPD-12
At Tennessee Tech
University, Social
security numbers of
990 students have been
lost due to a misplaced
portable flash drive.
California health
regulators fined Kaiser
Permanente's
Bellflower Hospital
$250,000 for failing to
keep employees from
viewing the medical
records of a patient.
At JaxFederal Credit
Union, client account
numbers and Social
Security numbers were
accidentally posted on
the Internet because
the printer did not
encrypt the data being
transmitted on the
network.
Department of
Workforce
Development
(Indianapolis)
accidentally disclosed
4,500 Social Security
numbers due to a
printing error made by
a printing vendor.
Education institutions
are adopting the online
environment in their
service area –
applications, class
notes, medical records,
etc.. This electronic
environment is
vulnerable to security
threats.
With innovative
technological advances,
Healthcare now needs
to share important
medical data and
patient information
electronically, creating
a major security
concern.
Financial services have
critical issues in IT
security because
more business is
being conducted
electronicallythan
ever before.
The government puts
an emphasis on
simplifying processes
and improving cross-
agency collaboration.
To do so, the
government employs
the latest technologies,
while implementing
strict regulations.
•Information
Technology
Management Reform
Act of 1996
•National Institute of
Standards and
Technology
Publication 800
•Health Information
Technology for
Economic and Clinical
Health, 2009
REGULATIONS
EXAMPLES OF
INFORMATION
SECURITY
BREACH CASE
GENERAL
REQUIREMENTS

WHITE PAPER SAMSUNG MFP SECURITY
Page - 10 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
3. Security Business Requirements
Businesses today are constantly creating new ways to use information. IT professionals have the demanding task of
protecting that information from new ways of abuse. The most successful strategy for protecting this information is by
implementing best practices for user authorization and to use devices that provide a high level of security.
Samsung MFP devices employ high levels of security to meet or exceed today’s business security requirements. We are
also working with our business customers to continuously improve our MFP security features.
3.1 Public Sector (Government / Education / Healthcare)
Security Requirements
Public sector entities have very specialized security needs. The military must be able to protect sensitive information from
foreign interests. Schools need to be able to protect the integrity of their student’s grades. Healthcare systems must
protect the privacy of their patients.
3.1.1 Government
U.S. government requirements include hard drive overwriting schemes that digitally shred the latent document
information from the hard drive of a device. When devices with hard drives are removed from secure sites, the hard drives
must be removed and physically destroyed.
Regulatory requirements that require these practices include the following:
•FISMA
This regulation requires a mandatory set of processes that must be followed for all information systems used or
operated by a U.S. federal government agency.
•HSPD-12
A common identification standard used to ensure that government facilities and sensitive information stored in
networks remain protected.
Enterprise
SMB
DataSecurity
Compliance
Protection
from Damage
to IT Infra.
Secure
Communication
Emerging
Technologies 6%
11%
16%
19%
37%
6%
9%
13%
24%
36%
Manyregulations and IT
bestpractices prescribe
appropriatesecurity
requirements to which
organizations, especially
within regulated verticals,
must comply.
Datasecurity, data leak
prevention, identity
management,security
information logging, and
eventmanagement are
themost important
security categories.
Regulatory Compliance
•Gartner, Security PurchasingBehaviors,Worldwide,2008
•Gartner, GlobalSMBSecurity PurchasingBehaviors, 2008

SAMSUNG MFP SECURITY WHITE PAPER
Page - 11 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
3.1.2 Education
Education requirements include protecting data from teachers, students, or other staff who engage in unauthorized
behavior, either knowingly or inadvertently. These activities can include: improper storage of passwords, students
practicing their hacking abilities, and individuals attempting to access the system to modify their grades. Many of these
risks can be avoided by implementing usage policies. These policies can add clarity to the tasks required of the network
administrator. The policies should include the following:
•Password Policy
•Acceptable Use Policy;
•Anti-Virus Procedures;
•E-mail Policy;
•Remote Access Policy;
•Encryption Policy;
•System Audit Procedures;
•Confidentiality and Data Distribution Procedures
•Copyright Compliance Policy.
Regulatory requirements that require these practices include the following:
•FERPA
A federal law that protects the privacy of student education records.
•FISMA
Requires a mandatory set of processes that must be followed for all information systems used or operated by a U.S.
federal government agency.
•HSPD-12
A common identification standard used to ensure that government facilities and sensitive information stored in
networks remain protected.
3.1.3 Healthcare
The healthcare industry is required to manage highly sensitive and private information for all of the patients in the system.
Advances in IT have allowed them to manage this data more efficiently and cost-effectively, and it has allowed patients to
be more proactive in managing their personal healthcare data. Now medical records are documented electronically in the
exam room, patients can request their records over e-mail, and health records can be accessed online. All of these
advances in management, distribution, and storage of health records also make them vulnerable to unauthorized access.
Regulations requiring the healthcare industry to protect this information from unauthorized access include HIPAA
compliance.
HIPAA Compliance
Electronically-distributed patient information requires strong data security. The Health Insurance Portability and
Accountability Act of 1996 (HIPAA), requires that Protected Health Information (PHI) remain secure at all times. In
addition, recent regulations and mandates from the Department of Health and Human Services apply to HIPAA covered
entities and any of their business associates that “access, maintain, retain, modify, record, store, destroy, or otherwise
hold, use, or disclose unsecured PHI.”

WHITE PAPER SAMSUNG MFP SECURITY
Page - 12 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
3.2 Private Sector Security Requirements
Private sector security requirements include authorization and encryption which is standard across all business sectors.
However, private businesses have the added requirement of SOX compliance.
SOX
The Sarbanes-Oxley Act of 2002 (SOX) was enacted in response to several high-profile financial scandals. The SOX act is
aimed at enforcing corporate responsibility by improving financial disclosures, and avoiding corporate and accounting
fraud. SOX contains many requirements aimed at standardizing financial reporting procedures. The requirement that
targets IT policies is section 404 of the act, “Management Assessment of Internal Controls.”
COBIT
The Control Objectives for IT (COBIT) is a framework that is commonly used by IT departments to comply with SOX.
COBIT is set of standard IT policies and procedures that can be adopted by all businesses. By using COBIT, an organization
can quickly design IT controls to comply with SOX. This includes deploying the right security solutions in the right areas:
•Identity Management
Each user must be uniquely identifiable. User identities and access rights must be maintained in a central repository.
•User Account Management
Account management procedures must exist for requesting, establishing, issuing, suspending, modifying, and closing
user accounts and related user privileges, as well as performing regular management reviews of all accounts and
related privileges.
•Logs, Alerts and Reports
Logging and alerting policies require recording and notification of abnormal access events. Reporting policies require
authorized managers to generate periodic event and log reports.
•Network Devices
This regulation requires secure network devices to be used to ensure authorized system access and to preserve
information integrity to and from networks. Network devices should be capable of central management from remote
locations. Devices should deliver a high level of data security by providing strong, full-disk encryption and access
control to ensure the secure exchange of sensitive data by ensuring the integrity and authenticity of data.
SOX section 404 compliance provides the momentum for most IT organizations to develop and document the IT security
controls and processes needed to support financial reporting. Protecting the integrity of information and controlling
access to resources are not only essential elements for the preservation of a company but are also requirements for
compliance.

SAMSUNG MFP SECURITY WHITE PAPER
Page - 13 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
4. Common Criteria Security Validation
Information systems are growing every day and the IT professionals that manage these
systems need to keep up with this growth. As with all other aspects of business these
days, they are trying to achieve more without adding any new personnel. To
streamline the process of choosing network devices, a standard has been
developed for certifying the security features/claims of a device. The process is known
as Common Criteria.
Only when each of the security features passes Common Criteria testing does the device
security level get rated and do they issue a Common Criteria certificate.
Products validated under the Common Criteria program provide customers with a high degree of confidence that they
address the security issues described in the posted evaluation documents. CCRA posts the claims and evaluation reports
on their Web site. Listings can be accessed by going to the Common Criteria Portal: http://www.commoncriteriaportal.org/
Samsung is proud to have received EAL 3 certification for our MFP security features.
The Common criteria conformances were either to Samsung Security Target (1) or to IEEE-2600-2009.1 Protection Profile.
(1) Samsung Security Target includes a set of security claims that have been validated by a Common Criteria certified lab. For more details, refer to the listings on the
following web page: http://www.commoncriteriaportal.org/.

WHITE PAPER SAMSUNG MFP SECURITY
Page - 14 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
5. IEEE 2600™-2008, IEEE 2600.1™-2009, IEEE 2600.2™-2009 (2)
The Institute of Electrical and Electronics Engineers (IEEE) Standards Association (IEEE-SA) is a recognized standards
sanctioning body responsible for creating, developing, integrating, sharing, and applying knowledge about information
technologies and sciences. The IEEE SA developed new security standards focused on modern network printers and
hardcopy peripherals (such as copiers and multifunction devices) with the goal of preventing unauthorized access.
The IEEE 2600™-2008, "Standard for Information Technology: Hardcopy System and Device Security standard defines
security requirements (all aspects of security including but not limited to authentication, authorization, privacy, integrity,
device management, physical security and information security) for manufacturers, users and others on the selection,
installation, configuration and usage of hardcopy devices and systems; including printers, copiers, and multifunction
devices.
For more information about IEEE 2600™, go to: http://standards.ieee.org/getieee/2600/index.html
This standard identifies security exposures for these HCDs and systems, instructs manufacturers and software developers
on appropriate security capabilities to include in their devices and systems, and instructs users on appropriate ways to use
these security capabilities.
Prior to IEEE 2600, there were no standards to guide manufacturers or users of hardcopy devices in the secure installation,
configuration, or usage of these devices and systems.
Based on the IEEE 2600-2008 standards the IEEE developed the following standards:
•IEEE 2600.1-2009
•IEEE 2600.2-2009
These standards provide a set of criteria/security requirements for Common Criteria labs, so they can verify that an MFP
meets the IEEE standard requirements.
By complying with the IEEE 2600.1™-2009 standard, Samsung also complies with the IEEE 2600-2009.2 standard. (3)
Samsung is a proud sponsor of this new standard and the new MFPs are now certified for the IEEE 2600.2-2009
standards.
For more information, refer to the listings on the following IEEE website:
http://grouper.ieee.org/groups/2600/conforming_products.html.

SAMSUNG MFP SECURITY WHITE PAPER
Page - 15 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
6. Samsung’s Security Framework
Samsung defines its security framework with five security categories to cover
all areas of security in the business environment. This framework is built to
protect your most important information and keep your documents safe
throughout the document life cycle. The categories of this framework include
the following:
1. Secure User
2. Secure Data
3. Secure Network and Fax
4. Secure Document
5. Secure Management
•
N/W Access Control
MFP
PC
Internet
PC
Firewall
PC
Internet
PC
Firewall
Secure
Network
Secure
Network
& Fax
Secure User
Secure Data
Secure Document
Secure Mgmt.
Storage
Server
•
Authentication
•
Authorization
•
Accounting
•
N/W Access Control
•
N/W Access Control
MF
P
PCPC
Internet
PCPC
FirewallFirewall
PCPC
Internet
PCPC
FirewallFirewall
Secure
Network
& Fax
Secure User
Secure Data
Secure Document
Secure Mgmt.
Storage
•
Data Encryption
•
Image Overwrite
•
Secure Print
•
Secure Fax
•
Watermark
•
Stamp
•
Job Auditing
•
Log Management
•
Data Backup
•
E
-
Mail Notification

WHITE PAPER SAMSUNG MFP SECURITY
Page - 16 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
7. Secure User
The Secure User category of the Samsung Security Framework includes the
features needed to protect the MFP from access by unauthorized users.
These features include the following:
•System Authentication (for Administrators)
•Authentication ( Local, NW)
•XOA-E / XOA Web Authentication
•Authorization (Group/Role Management)
•Accounting
•Single Sign-On (SSO).
The Secure User feature is designed to allow only authorized users to access the MFP, protecting your valuable
information from unauthorized access.
Both large office groups and small to medium size offices can use our secure user features to easily enhance their secured
environment.

SAMSUNG MFP SECURITY WHITE PAPER
Page - 17 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
7.1 Authentication
Authentication is used by Samsung MFPs to confirm that a user has rights to access the MFP. MFP authentication includes
the following security checks:
•System Authentication
•Local Authentication
•N/W Authentication
•Employee Badge / HID Proximity Card
•Smartcard Authentication / Common Access / PIV Card
7.1.1 System Authentication
Samsung MFPs require the system administrator to enter their authentication information before allowing access to the
system management menus. The System Administrators role includes SyncThruTM Web Service administrators and the
local system administrator. The authentication process for the SyncThruTM Web Service administrator uses an account
and a password on the user interface, the authentication process for the local MFP system administrator uses a PIN
number on the MFP user interface. The system administrator must enter a PIN to access the system administration
functions. The SyncThruTM Web Service administrator must enter their account and password in to the SyncThruTM Web
Service UI, and the local administrator must type their PIN number in to the MFP UI. The security software displays
asterisks instead of characters to hide the characters they enter.
The authentication process is delayed by the MFP UI for three minutes when 3 wrong PINs are entered in succession.
When 3 wrong PINs are entered in the SyncThruTM Web Service UI from one particular browser session, the security
software will send an error message to the browser session screen.
7.1.2 Local Authentication
When the Authentication mode is enabled, a local MFP user must enter a password to access the menu. The password for
a local MFP user can be up to 15 characters in length, and it can include alphabetic, numeric and special characters. The
password complexity consists of upper case letters, lower case letters, numbers and special characters.
7.1.3 Network Authentication
The Samsung MFP prevents unauthorized use of the network options (network scanning, scan-to-e-mail, and scan-to-
server). The MFP System Administrator sets the network options available for each user. To access a network service, the
user must provide a user name and password, which is then validated by the designated authentication server.
Network authentication includes 802.1x, Kerberos, SMB and LDAP. LDAP (Lightweight Directory Access Protocol) is a
software protocol for enabling anyone to locate organizations, individuals, and other resources such as files and devices on
a network, whether on the public Internet or on a corporate intranet.
7.1.4 XOA –E / XOA Web Authentication
The Samsung MFP additionally provides XOA-E / XOA Web authentication to prevent unauthorized use of the network
options (network scanning, scan-to-e-mail, and scan-to-server). XOA-E authentication server is located inside MFP and
XOA Web authentication server is located outside MFP. That is, the Samsung MFP provides various authentication
methods which are implemented by ISVs

WHITE PAPER SAMSUNG MFP SECURITY
Page - 18 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
7.2 User Authentication Scenarios
The following are examples of different user authentication configurations.
7.2.1 For Administrators
Method Setup
The Authentication Method can be set up by using the Local UI and the Web-UI. Only Administrator can use these
functions, after logging in to the MFP. The Administrator can select from the following methods: No Authentication, Local
Authentication, Network Authentication (Kerberos, SMB, and LDAP), and XOA-E/XOA Web Authentication.
Local UI:
SyncThruTM Web Service UI:

SAMSUNG MFP SECURITY WHITE PAPER
Page - 19 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
ID and Password Setup
The system administrator can create each user’s ID and Password by using the Web-UI.
When the Authentication mode is enabled, a User can log in to the device through the Local UI or through a Network
connection. Only authorized users can access the device after successfully logging on. The following are examples of
Local and Network login screens:
7.3 Authorization (Group/Role Management)
A common form of user management is known as Role-Based Access Control (RBAC). By using a defined set of roles, an
administrator can easily assign access to a user by assigning them to a role. Adding a user to a group also allows the
administrator to manage access for large groups of users. Examples of Roles for the MFP are Print only; Scan Only, Copy
Only or any combination of these and others.
7.3.1 Using Group and Role-Based Authority
The Administrator can create several groups with different user roles by using SyncThruTM Web Service. With this function,
the user property of Authorization, Authentication and Accounting can be controlled by Group/Role definitions. For
example, when Group “A” has only “Copy” authority, a user in that group can only use 1 Copy feature but not other
features like Faxing or Scanning.

WHITE PAPER SAMSUNG MFP SECURITY
Page - 20 Copyright2014 Samsung Electronics Co., Ltd., All rights reserved.
7.4 User Authorization Scenarios
The following are overviews of User Role and Group menus.
7.4.1 Administrator Menu
The Administrator uses the Web UI to set up the Role and Group Authorization modes. This feature is only accessible to
the Administrator and it requires an ID and password.
The features that can be assigned to Users and Groups include the following:
•Color
•Copy
•Fax
•Document Box
•Scan To USB
•Scan To E-mail
•Scan To Server
•Scan To PC
•Address Book
•Job Quese
•Admin Setting
Each feature can be given one of the following permissions:
•Unlocked
•Locked Visible
•Locked Hidden.